TranceAddict Forums (www.tranceaddict.com/forums)
- Chill Out Room
-- had to take my webserver down, security advise?
had to take my webserver down, security advise?
i decided to shut down my webserver because i noticed in the event log that it has been HAMMERED for the past 48 hours by some jackass(es) trying to get onto it with every username in the book, especially the admin account.
it currently is running ISA Server 2000 and is behind an cheap SPI firewall (port forwarding, not DMZ) and I was thinking of putting BlackICE Server on it in addition to. The admin account has been renamed from the start, but are there any recommendations to keep my webserver secure without buying hardware?
It looks like they succeeded in f'ing it up cuz the one of the volumes is corrupt now, luckily I have backup so no biggie cuz I needed to actually repartition it anyway.
LAMP?
| quote: |
| Originally posted by gehzumteufel LAMP? |
| quote: |
| Originally posted by Dj Dizzy Basically it's a VMware machine running Windows Server 2003 Web Edition w/ ISA 2000 and I'm using IIS for the website. Maybe that's my first mistake, I've never used Apache so I used IIS out of familiarity. I've never heard of LAMP but I just looked it up, is that available for Apache for Windows? Or should I seriously consider creating a Linux server instead, if I do that then I lose the ability to run BlackICE, etc on it though cuz I only have it for Windows. |
| quote: |
| Originally posted by gehzumteufel blackICE as in the firewall app? no worries cause there are many other linux firewall apps available anyways. iptables comes to mind. |
| quote: |
| Originally posted by Dj Dizzy yeah I have BlackICE Server Protection 3.6 the firewall software but didn't think I would need it. Would it really be better for me to go LAMP like you suggested and run a Linux server with a Linux firewall or do you think it would be okay for me to keep Windows Server 2003 w/ ISA 2000 and load BlackICE and dump IIS for Apache. |
so I brought it back up and wasn't so lazy about security this time around. i was also running an FTP along with the website through IIS on the same partition, I'm thinking the FTP is how the were able to go nuts on the server.
So I:
*partitioned the drive into 3 different volumes to keep everything segregated (one for the OS/apps, second for the website files, third for the ftp)
*dumped IIS altogether and now running Apache for the website and FileZilla for the FTP
*changed all pages from ASP to PHP with NoExec noted in Apache
*Still running ISA on Windows Server 2003 Web Edition
I think I should be good now but we'll see
find him and kill him. who needs a firewall when you have a gun
| quote: |
| Originally posted by nchs09 find him and kill him. who needs a firewall when you have a gun |
| quote: |
| Originally posted by Dj Dizzy so I brought it back up and wasn't so lazy about security this time around. i was also running an FTP along with the website through IIS on the same partition, I'm thinking the FTP is how the were able to go nuts on the server. So I: *partitioned the drive into 3 different volumes to keep everything segregated (one for the OS/apps, second for the website files, third for the ftp) *dumped IIS altogether and now running Apache for the website and FileZilla for the FTP *changed all pages from ASP to PHP with NoExec noted in Apache *Still running ISA on Windows Server 2003 Web Edition I think I should be good now but we'll see |
Haven't used IIS in a while , I must say Apache 2.2 looks really secure and doesn't take up much resources, your http.conf config files are really easy to edit. Also you can implement additional SSL Security in seconds, also you can restrict I.P Addresses or Ranges.
You could also use a different Server Port to try and hide your server better.
LAMP =
Linux
Apache
MySQL
PHP
Apache is available for Windows and is pretty solid.
Since you're running in a VM environment anyway, you could give Linux a try. I don't know if there's a similar thing to iptables in the Windows stack, but you could have it automatically add rules to iptables to block people that make a ridiculous amounts of attempts on whatever services you're running.
What exactly are you running on your webserver, anyway? I used to run one on my computer for development purposes, but it was compromised (through phpMyAdmin). I ended up just requiring a user/pass for the entire site, but I guess that still doesn't help with people trying to brute-force credentials.
| quote: |
| Originally posted by AnomalyConcept LAMP = Linux Apache MySQL PHP Apache is available for Windows and is pretty solid. Since you're running in a VM environment anyway, you could give Linux a try. I don't know if there's a similar thing to iptables in the Windows stack, but you could have it automatically add rules to iptables to block people that make a ridiculous amounts of attempts on whatever services you're running. What exactly are you running on your webserver, anyway? I used to run one on my computer for development purposes, but it was compromised (through phpMyAdmin). I ended up just requiring a user/pass for the entire site, but I guess that still doesn't help with people trying to brute-force credentials. |
| quote: |
| Originally posted by Dj Dizzy I'm just running a little website http://ATLscene.servemp3.com If it has problems with the current setup it's on now then I'll try it with the LAMP setup that was mentioned and dump Windows. Unfortunately I can't run any SQL or db apps on the webserver since it's web edition, it's stripped down alot and focuses only on webhosting, although I must say it doesn't even do that very well. |
Powered by: vBulletin
Copyright © 2000-2021, Jelsoft Enterprises Ltd.